Request tags, with refusing and limits per tag (closes #175)

Each request gets sorted tags from the lookup, new address lists, the
reputation sources and the rule matches, logged as `tags`. New settings:
`SWW_TAG_LISTS`, `SWW_TAG_DENY`, `SWW_TAG_LIMIT_PERCENT`. They replace
`SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and
`SWW_DENIED_COUNTRIES`. New heuristics `tag_lists` and `tag_deny`; the
latter runs before the rate limits and again after the Core Rule Set.

Model: opus-5-5

internal/discriminator/observe_test.go

@@ -50,7 +50,7 @@ func TestObserveModeForwardsWhatEnforceModeRefuses(t *testing.T) {
 				lookupTimeout:      "1h",
 				rateLimitPerMinute: "1",
 				denyNets:           denied,
-				deniedCountries:    "kp",
+				tagDeny:            denyKP,
 			}
 
 			if tc.setting != "" {
@@ -71,7 +71,7 @@ func TestObserveModeForwardsWhatEnforceModeRefuses(t *testing.T) {
 			for _, sent := range []struct{ from, refusal string }{
 				{denied, requestlog.ActionDenied},
 				{banned, requestlog.ActionBanned},
-				{fromKP, requestlog.ActionCountryDenied},
+				{fromKP, requestlog.ActionDenied},
 				{fromDE, requestlog.ActionRateLimited},
 			} {
 				if !tc.observe {